packagekit: attach timer to stream rather than backend

this ensures the timer gets resolved as part of stream deletion (if it
happens before the timer timeouts anyway).